Missing authorization in the vgdevsolutions Checkout Gateway for IRIS plugin allows attackers to exploit incorrectly configured access control levels, enabling unauthorized users to access or manipulate checkout functionality. This broken access control can lead to unauthorized reads or modifications of transaction data without requiring user credentials. The issue is identified as CWE-862, a classic example of missing or improper authorization.

Affected: vgdevsolutions’ Checkout Gateway for IRIS plugin, all releases up to and including version 1.3. Users running any version from the initial release through 1.3 are vulnerable.

The CVSS score of 6.5 indicates a medium severity impact. The EPSS score of less than 1% suggests a low but non‑zero likelihood of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would require the plugin to be installed and an attacker to target the exposed endpoints, likely without special privileges, as the access control is incorrectly enforced. The primary risk is unauthorized manipulation of checkout transactions rather than remote code execution.